The company had grown from forty people to just under two hundred in eighteen months. Engineering had shipped fast and well, and the infrastructure had grown with it: new environments for new products, a second cloud account nobody quite remembered opening, integrations with partners that had been urgent at the time.
Nobody had done anything wrong. The picture had simply outgrown the people holding it in their heads.
What we found
We mapped what was reachable from the internet and traced each asset back to a team and a purpose. That is the part most inventories skip, and it is the part that matters: an asset without an owner is not a risk you can act on, it is a question you keep asking.
- Two staging environments serving real customer data, indexed and public
- An administrative interface on a partner integration with no access control
- Certificates on six services expiring inside ninety days, none of them tracked
- Three cloud accounts, one of which had no named owner at all
The two staging environments had been open for over a year. Neither showed up in any security tool, because neither was in any asset list.
What we did
We rated each finding by what it would cost the business rather than by a technical score, and put them in the order the team could actually work through. The urgent things were fixed inside the first fortnight, mostly by the client's own engineers with us alongside.
The rest went into a plan with dates and names against it, and a short standing review so it stayed current as the estate kept moving.
Where it left them
The security conversation stopped being a list of open questions raised at every board meeting and became a single roadmap with a known length. That mattered more than any individual fix: the team could say what was outstanding, why, and when it would be done.